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ABSTRACT 

In this paper, an approach for in-flight fault detection and 
isolation (FDI) of aircraft engine sensors based on a bank of 
Kalman filters is developed. This approach utilizes multiple 
Kalman filters, each of which is designed based on a specific 
fault hypothesis. When the propulsion system experiences a 
fault, only one Kalman filter with the correct hypothesis is able 
to maintain the nominal estimation performance. Based on this 
knowledge, the isolation of faults is achieved. Since the 
propulsion system may experience component and actuator 
faults as well, a sensor FDI system must be robust in terms of 
avoiding misclassifications of any anomalies. The proposed 
approach utilizes a bank of (m+ 1) Kalman filters where m is the 
number of sensors being monitored. One Kalman filter is used 
for the detection of component and actuator faults while each of 
the other m filters detects a fault in a specific sensor. With this 
setup, the overall robustness of the sensor FDI system to 
anomalies is enhanced. Moreover, numerous component fault 
events can be accounted for by the FDI system. The sensor FDI 
system is applied to a commercial aircraft engine simulation, 
and its performance is evaluated at multiple power settings at a 
cruise operating point using various fault scenarios. 


INTRODUCTION 

In-flight sensor fault detection and isolation (FDI) is 
critical to maintaining reliable engine operation during flight. 
The propulsion system is operated at demanded conditions by 
the aircraft engine control system which computes control 
commands based on sensor measurements. Any undetected 
sensor faults, therefore, may cause the control system to drive 
the engine into an undesirable operating condition. If a sensor 
fails, it is crucial to detect and isolate the fault as soon as 
possible so that such scenarios can be avoided. A sensor FDI 
system which is capable of doing so with high reliability is 
indispensable for flight safety enhancement. A challenging 
issue in developing reliable sensor FDI systems is to make 
them robust to other faults, besides sensor faults, that can occur 
during flight. Engine component performance can degrade 


gradually due to usage, and abruptly due to fault events such as 
foreign or domestic object damage. Likewise, errors can exist 
between the commanded and actual actuator positions. Such 
anomalies result in shifts in sensed engine variables from their 
nominal values. Therefore, a sensor FDI system which is 
developed without accounting for possible component or 
actuator faults may result in false alarms, missed detections, or 
misclassifications when such faults do occur. 

An approach to in-flight sensor FDI for aircraft propulsion 
system was addressed by Merrill et al. [1| through the 
utilization of a bank of Kalman filters. In this approach, each 
Kalman filter is designed based on a specific hypothesis (such 
as the failure of a specific sensor). When a single sensor fails, 
only the one Kalman filter with the correct fault hypothesis can 
maintain low residual values, indicating that the specific sensor 
has failed. This work was later extended by Kobayashi et al. 
[2] to account for not only sensor faults, but also actuator and 
component faults. This approach exhibited improved robustness 
of the FDI system; however, the number of component fault 
events that could be accounted for by the FDI system was 
limited to the number of available sensors. In spite of such 
limitations, the previous research [2] revealed potential areas 
for further improvement of an FDI system. In this paper, 
lessons learned from the earlier work are incorporated to 
enhance the bank of Kalman filters for an in-flight sensor FDI 
application. The objectives of sensor FDI are as follows: 

• Avoid missed detections: When a single sensor is 
faulty, it must be correctly detected and isolated. 

• Avoid false alarms: Non-fault-related factors that exist 
in the real environment, such as sensor noise and 
modeling uncertainty, should not be diagnosed as a 
sensor fault. 

• Avoid misclassifications: Component or actuator 
faults should not be misclassified as a sensor fault. 

In this paper, a sensor FDI system is developed and applied 
to a nonlinear simulation of a commercial aircraft gas turbine 
engine. The FDI system performance is evaluated at multiple 
power settings at a cruise operating point using various fault 
scenarios. 
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NOMENCLATURE 


BST 

Booster 

FAN 

Fan 

FDI 

Fault detection and isolation 

HPC 

High-pressure compressor 

HPT 

High-pressure turbine 

LPT 

Low-pressure turbine 

P25 

HPC inlet pressure 

PLA 

Power lever angle 

PS3 

Combustor inlet static pressure 

T25 

HPC inlet temperature 

T3 

Combustor inlet temperature 

T49 

LPT inlet temperature 

TMHS23 

BST metal temperature 

TMHS3 

HPC metal temperature 

TMHS41 

HPT nozzle metal temperature 

TMHS42 

HPT metal temperature 

TMHS5 

LPT metal temperature 

TMHSBC 

Combustor case metal temperature 

TMHSBL 

Combustor liner metal temperature 

VBV 

V ariable bleed valve 

VSV 

Variable stator vane 

WF36 

Fuel flow 

XN12 

Low-pressure spool speed, measured 

XN25 

High-pressure spool speed, measured 

XNH 

High-pressure spool speed, state variable 

XNL 

Low-pressure spool speed, state variable 


DEVELOPMENT OF ROBUST SENSOR FAULT 
DETECTION AND ISOLATION SYSTEM 

The problem approach to sensor FD1 is similar to that of 
reference [2]. A depiction of the propulsion system with the 
sensor FDI system is shown in fig. 1 . During flight, the sensors, 
actuators, and engine components are susceptible to failure. 
The sensor and actuator faults dealt with in this paper are “soft” 
failures. Soft failures are defined as inconsistencies between 
true and measured sensor values (or true and commanded 
actuator position) that are relatively small in magnitude and 
thus difficult to detect, whereas “hard” failures are large in 
magnitude and thus more readily detectable. Soft failures can 
take different forms such as a fixed scale factor, a fixed bias, a 
drift, or intermittent spikes. Among these, only the fixed bias is 
considered in this paper for FDI evaluation purposes, although 
the proposed FDI approach is applicable to other soft failure 
types as well. Engine component faults are modeled in the 
simulation environment by abruptly shifting the health 


Component 


Actuator Fault Fault Sensor Fault 



In-flight FDI 

• Sensor fault detection and isolation 

• Detection of component/actuator fault 


Figure 1. Propulsion System with Sensor Fault 
Detection and Isolation System 


parameters which indicate component performance deviations 
from a reference base point. 

The FDI system uses two sets of input signals: sensor 
measurements and control commands. Those sensors used by 
the control system are also used by the FDI system for 
monitoring purposes. Given these two sets of input signals, the 
FDI system seeks to detect and isolate any faulty sensors. The 
approach to sensor FDI is based on the utilization of a bank of 
Kalman filters, where each filter is designed with a unique 
hypothesis to monitor a specific sensor. In addition to sensors, 
components and actuators may also fail during flight. 
Therefore, it is necessary to make the FDI system robust to 
these faults so that misclassifications of component and 
actuator faults as sensor faults do not occur. This issue is 
addressed by designing one additional Kalman filter which 
assumes that components and actuators may be faulty. When 
the propulsion system experiences a sensor fault or 
component/actuator faults, only the one Kalman filter with the 
correct hypothesis is able to maintain accurate estimation 
performance. Consequently, the detection and isolation of 
sensor faults or the detection of component/actuator faults can 
be achieved. As can be seen in fig. 1, the outputs of the FDI 
system are not integrated with the control system in the present 
work. The integration of these systems for fault accommodation 
purposes will be pursued in future work. In the following 
sections, the design approach for the FDI system is discussed in 
detail. 
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Kalman Filter Design for Sensor Fault Detection 

The Kalman filter design approach is based on the linear 
model representation of a plant. The linearized engine model 
under consideration is represented by the following state space 
equations: 

x = A(x-x ss ) + L(h- h ref ) + B(u cmd - u ss ) + Bb . 

y-y ss =C(x- x ss ) + M(h- h ref ) + D(u cmd -u ss ) + Db + v 

where the vectors x, h, u cmil represent state variables, health 
parameters, and control commands, respectively. The subscript 
“ss” indicates the steady-state point (or the base point at which 
the model was linearized). The vector h reJ represents a reference 
health condition. The sensor measurement vector, y, is 
corrupted by sensor noise v. The vector b represents the bias in 
the actuation system; it is zero when there is no actuator bias. 
The health parameter and bias vectors are unknown inputs to 
the system that affect engine operation. The matrices A, B, C, 
D , L, and M have appropriate dimensions. 

For sensor fault detection, m Kalman filters are designed 
where m is the number of sensors being monitored. Each 
Kalman filter estimates the state vector using a unique set of 
(m-1) sensors. The sensor which is not used by a particular 
filter is assumed to be the potentially faulty one (fault 
hypothesis) and thus monitored by that filter. For instance, the 
i"' filter uses the sensor subset y' that excludes the i"' sensor, 
where i is an integer from 1 to m. When the 1 sensor is faulty, 
all Kalman filters use faulty information except for the i"‘ filter. 
Consequently, the i"‘ filter is able to accurately estimate the 
state vector from fault-free sensor measurements, whereas the 
estimates of the remaining filters are distorted by the faulty 
sensor measurement. The Kalman filter equation that monitors 
the i"‘ sensor is given as follows: 

x= A(x-x ss ) + B(u cmd -u ss ) + K'(y l -y') 
y‘ -yls =c'(x-x ss )+D'(u cmd -u ss ) 

where x and y‘ are the estimates of the state vector and the i"‘ 

sensor-subset vector, respectively. The matrices C' and D' 
are a subset of C and D, respectively, with the 1 row deleted, 
and K' is a Kalman gain matrix corresponding to the matrix 
pair (A,C‘) . In order for the Kalman filter to converge, the 

matrix pair (A, C' ) must be observable. 

The accuracy of the estimated state variables is indicated 
by a weighted sum of squared residuals (WSSR) which is 
computed as follows: 


WSSR' = (y‘ - y' ) T y 1 (y‘ -y 1 ) (3) 


where 

2' = diag[a ‘ ] 2 

The vector cr' represents the standard deviation of the i"‘ 
sensor-subset. The square matrix 2' normalizes the residual 
vector (y l -y'). The value of the fault indicator signal, 
WSSR, increases if the sensor subset used by a Kalman filter 
contains a faulty measurement. In order to detect an anomaly 
in the sensor set, the fault indicator signals are compared 
against pre-established detection thresholds. If all fault 
indicator signals except one exceed the threshold, it indicates 
that the Kalman filter whose fault indicator signal did not 
exceed the threshold is the one with the correct fault 
hypothesis. Consequently, this filter is isolated, and the sensor 
excluded by this filter is identified as the faulty one. 

It should be noted that the Kalman filter in eq. (2) does not 
account for the influence of health parameters or actuator biases 
that appear in eq. (1). Therefore, any deviations of these 
parameters from the design point can cause an increase in the 
values of the fault indicator signals. Depending on their 
magnitude, such deviations may induce a fault misclassification 
scenario where all fault indicator signals except one exceed the 
detection threshold. To avoid such scenarios, additional 
features that account for health parameter and actuator bias 
deviations must be built into the FDI system. For the health 
parameters, two possible deviation types need to be considered: 
1 ) gradual degradation due to aging, and 2) abrupt degradation 
due to component faults. An approach to deal with the gradual 
degradation was discussed in reference [2]. That is, estimate all 
health parameters once per a number of flights using ground- 
based trend monitoring techniques [3,4,5], update the reference 
health condition (h,) and the linear engine model in eq. (1), and 
then update the Kalman filter. As long as this updated 
reference health condition remains close enough to the actual 
condition (which continues to degrade with time), the 
interference of the gradual degradation on the Kalman filters 
designed through eq. (2) will remain small. Abrupt degradation 
(A h=h-h. in eq. 1) due to component faults or actuator bias 
needs to be handled by other means. The approach taken in this 
paper is to design another Kalman filter which assumes that 
components and/or actuators may be faulty. If this filter is able 
to maintain low residual values in the case of component and/or 
actuator faults, misclassifications of these faults as a sensor 
fault may be avoided. The design of this additional Kalman 
filter is discussed in the following section. 


Kalman Filter Design for Component and Actuator 
Fault Detection 

Ideally, a Kalman filter which is capable of accurately 
estimating all health parameters is desirable. Such a filter 
would be able to maintain accurate sensor estimation (and thus 
low residuals) even in the presence of component faults. 
However, the number of health parameters that can be 
estimated is limited to the number of available sensors [6], 
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Aircraft engines have a limited number of sensors which is, in 
general, less than the number of health parameters. Therefore, 
estimating all health parameters is not realistic. An alternative 
approach, which can meet the aforementioned objective while 
using a limited number of sensors, is to estimate a subset of 
health parameters. In reference [2], it was observed that the 
Kalman filter, designed with a subset of health parameters, 
could retain accurate estimation of sensor outputs when applied 
to a “degraded” engine simulation. The accuracy of the 
estimated health parameters, however, was poor as the Kalman 
filter attributed the steady-state mismatch caused by health 
degradation to the subset of health parameters being estimated. 
Therefore, the estimated health parameters no longer indicate 
the actual health condition, but instead, they are “tuning” 
parameters that the Kalman filter can use to generate accurate 
sensor estimates. This concept of “tuning” is applied to the 
design of a Kalman filter in this section. The idea is to use 
tuning parameters (a subset of health parameters) with which 
the Kalman filter can maintain good sensor estimation 
performance no matter what combination of health parameters 
is shifted from their reference point. The Kalman filter 
equation that incorporates the tuning parameters is given as 
follows: 


A L d 

0 0 


( x au g ~ x ss) + 


(« cmd -u ss ) + K(y-y) 


(4) 


y - y ss = [c M d \x -x ss ) + D(u cmd -u ss ) 


WSSR = (y-y) r (X)- 1 (y-y) (5) 


where 


Z = diag[c>Y 

The vector a represents the standard deviation of the sensor 
set. It should be noted that this filter uses all sensors of the 
given sensor suite. The assumption of this filter is that all 
sensors are healthy and that components are potentially faulty 
(fault hypothesis). 

The fault indicator signal of this filter must meet two 
requirements: 1) it must remain small in the case of component 
faults and 2) it must increase in the case of a sensor fault. 
These two conditions are required to indicate whether the fault 
hypothesis of this filter is correct or incorrect. It was found that 
this WSSR could meet the first condition, but not the second 
one. In the case of a sensor fault, the WSSR could remain small 
depending on which sensor is faulty. After some investigation, 
it was found that, whenever the WSSR remains small in the 
presence of a faulty sensor, the sensor fault is attributed to the 
engine internal condition: the tuning parameters. In other 
words, the Kalman filter tries to “explain” a sensor fault by 
shifting the tuning parameters. If it is successful in doing so, 
the value of WSSR remains small. 

To address this shortcoming, another fault indicator signal 
is used. This signal, a weighted sum of squared tuners 
(WSST), is computed as follows: 


where 


WSST = W d (d T d) 


( 6 ) 


X 

, x cc = 

X ss 

d_ 

’ ss 

0 


The vector d contains the tuning parameters. The matrices L d 
and M d are selected columns of L and M, respectively, and their 
columns correspond to the tuning parameters. As discussed 
earlier, all health parameters gradually deviate from the healthy 
baseline. This deviation is called “baseline degradation” (h, in 
eq. 1) and can be tracked by ground-based trend monitoring 
techniques once per a number of flights. As the gradual 
degradation progresses, all Kalman filters need to be updated* 
based on the estimated baseline degradation so that the Kalman 
filters will operate within the linear range of a degraded engine. 
The tuning parameters are the deviation values from this 
updated reference point. 

Similar to the Kalman filters designed for sensor fault 
detection, the accuracy of the estimated sensor measurements is 
indicated by a weighted sum of squared residuals (WSSR) 
which is computed as follows: 


* It is desirable to update both state-space matrices and steady-state points. 
If this is not achievable, then at least the steady-state points must be updated, 
while maintaining the state-space matrices obtained at the healthy baseline 
condition. 


where W d is a designer selected weighting factor. Regardless 
of the fault type, the value of WSST increases when a fault 
occurs. However, the following two conditions were observed: 
1) the increase in WSST is generally small in the component 
fault case, and 2) the increase in WSST becomes excessively 
large whenever this Kalman filter maintains a low WSSR value 
in the presence of a faulty sensor. Based on these observations, 
the two fault indicator signals (WSSR and WSST) are used in 
combination to indicate whether the fault hypothesis of this 
filter is correct or incorrect. If both signals remain below their 
detection thresholds, the fault hypothesis is correct, i.e., 
component faults may exist but all sensors are healthy. If at 
least one of them exceeds the detection threshold, the fault 
hypothesis is incorrect, and thus a sensor fault is believed to 
exist. Through this approach, sensor and component faults can 
be distinguished. It should be noted that as the magnitude of a 
component fault increases, the value of WSST increases and 
eventually exceeds the detection threshold. By the time this 
happens, it is expected that each fault indicator signal generated 
for sensor fault detection would already have exceeded its 
threshold so that misclassifications of component faults as a 
sensor fault will be avoided. 

So far, only the component fault case has been discussed in 
this section. Actuator faults can be handled by either 
augmenting the tuning parameter vector in eq. (4) with the 
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actuator bias term in eq. (1) or designing single Kalman filters 
for each of the actuators as was done in reference [2]. 
However, a different approach is taken in this paper. When an 
actuator is biased, it causes a measurement shift in multiple 
sensors, similar to the component fault case. The Kalman filter 
designed with tuning parameters can handle such multiple 
measurement shifts and, therefore, is considered to have some 
robustness to actuator faults as well, i.e., the two fault indicator 
signals will remain small when actuators are faulty. Therefore, 
the Kalman filter with tuning parameters is used to detect both 
component and actuator faults. If this filter is not robust to 
actuator faults, then the designer must take one of the 
aforementioned approaches to meet design objectives. 

It should be noted that, when the Kalman filter with tuning 
parameters is isolated from the rest of the filters, the specific 
component(s) and/or actuator(s) which are faulty are not 
identified. For further diagnosis of the component and actuator 
faults, another set of Kalman filters, each designed for a 
specific fault event (such as foreign object damage, domestic 
object damage, fuel system failure, etc.), may be used. Since it 
is already known that a fault exists, a detection threshold is not 
needed. Instead, by ranking the likelihood of plausible faults 
based on the Kalman filter estimation accuracy, the possibility 
of misclassifications may be reduced. This process was 
demonstrated by Volponi et al. [7], and a high success rate was 
exhibited. 


Overall Sensor FDI Architecture 

The overall architecture of the sensor FDI system is shown 
in fig. 2. The FDI system is composed of a bank of ( m+l ) 
Kalman filters where m is the number of sensors being 
monitored. Kalman filters 1 through m are used to detect 
sensor faults while the (m+l)" Kalman filter is used for the 
detection of component/actuator faults. With this bank of 
Kalman filters, the following assumptions are made: 

• Only one sensor may fail at a time. 

• Multiple components and actuators may fail at a time. 

• Only one of the above two types of failures may occur 
at a time. 



• No Fault 

or 

• Fault Detected 

or 

• Fault Isolated 


y Ucmd 


Figure 2. Architecture of the Sensor FDI System 


In the fault isolation process, the fault indicator signal 
generated by each Kalman filter is compared against a pre- 
defined detection threshold. If a fault indicator signal exceeds 
the threshold, it indicates that the corresponding Kalman filter 
is using an incorrect fault hypothesis. The Kalman filter 
#(m+l) generates two fault indicator signals, and at least one of 
them must exceed the threshold to indicate that its fault 
hypothesis is incorrect. 

Table 1 summarizes the fault isolation process. There are 
eight possible scenarios, as enumerated in table 1, that the fault 
isolation process may encounter. When sensors, actuators, and 
components are all nominal, all fault indicator signals will 
remain below their thresholds, indicating that no fault exists in 
the system (scenario 1). When a fault occurs, the value of each 
fault indicator signal except for the one with the correct 
hypothesis will increase. The increased amount will vary for 
each fault indicator signal as each filter has a different response 
or sensitivity to a particular fault. Depending on the type and 
severity of the fault, some fault indicator signals may exceed 
their thresholds while others may remain below. If at least one 


Table 1. Summary o f Fault Isolation Process 



WSSR 0 "*" and WSST for Kalman Filter #(m+l) 
(Component and/or Actuator Fault Hypothesis Filter) 

Both remain below 
threshold 

Either one or both exceed 
threshold 

WSSR 1 

for Kalman 
filters #l~#m 
(Sensor Fault 
Hypothesis 
Filters) 

All WSSRs remain below threshold 

1 ) No fault exists 

2) Detection of fault 
(no isolation) 

At least one WSSR exceeds 
threshold and at least two WSSRs 
remain below threshold 

3) Detection of fault 
(no isolation) 

4) Detection of fault 
(no isolation) 

All but one WSSR exceed threshold 

5) Detection of fault 
(no isolation) 

6) Detection and isolation 
of sensor fault 

All WSSRs exceed threshold 

7) Detection of 
component/actuator fault 

8) Detection of large 
component/actuator fault 
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fault indicator signal exceeds its threshold, the fault isolation 
process declares that a fault was detected. However, the 
isolation of a fault can not be achieved as long as at least two 
Kalman filters do not have a threshold violation. Scenarios 2 
through 5 represent these cases where a fault can be detected 
but not isolated. When a threshold violation occurs for all 
Kalman filters except one, then this single Kalman filter is 
isolated from the rest, and the fault hypothesis used by this 
filter reveals the identity of the fault. Thus, the isolation of a 
sensor fault is achieved in scenario 6, and the detection of a 
component/actuator fault is achieved in scenario 7. Finally, as 
discussed earlier, when a threshold violation occurs for all 
Kalman filters, the fault isolation process declares that a large 
component/actuator fault has occurred (scenario 8). 


APPLICATION OF FDI METHODOLOGY TO AN 
AIRCRAFT ENGINE SIMULATION 

In this section, the FDI design methodology is applied to 
an aircraft engine simulation. A description of the engine 
simulation is given first. From the engine simulation, piecewise 
linear models are generated along the steady-state power setting 
line at a cruise condition. Based on these linear models, the 
piecewise Kalman filter model is developed in order to cover 
multiple power settings. 

Engine Model 

The engine model used in this paper is a nonlinear 
simulation of an advanced high-bypass turbofan engine. This 
engine is constructed as a Component Level Model (CLM), 
which assembles the following five major components of an 
aircraft engine: Fan (FAN), Booster (BST), High-Pressure 
Compressor (HPC), High-Pressure Turbine (HPT), and Low- 
Pressure Turbine (LPT). The health parameters, which 
represent the component performance deterioration, are 
adjustments to efficiency and flow capacity scalars of the above 
five components. The current version of the simulation does 
not have health parameters for the combustor. The engine state 
variables, health parameters, actuation variables, and sensor 
measurements are shown in table 2. 

The outputs of the seven sensors in table 2 are fed into the 
digital engine control unit. At the cruise operating condition 
evaluated in this study, the power lever angle (PLA) value is 


Table 2. State, Health, Actuator, and Sensor Variables 


State Variables 

XNL, XNH, TMHS23, TMHS3, TMHSBL 
TMHSBC, TMHS41, TMHS42, TMHS5 

Health 

Parameters 

FAN efficiency, FAN flow capacity 
BST efficiency, BST flow capacity 
HPC efficiency, HPC flow capacity 
HPT efficiency, HPT flow capacity 
LPT efficiency, LPT flow capacity 

Actuators 

WF36, VBV, VSV 

Sensors 

XN12, XN25, P25, T25, PS3, T3, T49 


converted to the desired corrected low-pressure spool speed (an 
indicator of thrust). The control system adjusts three actuation 
variables to cause the corrected measured low-pressure spool 
speed value to match the commanded value. PLA varies from 
38 to 72 degrees. 

The standard deviations of the sensor noise used in this 
paper are shown in table 3. The values are given in percent of 
the steady-state values at the maximum power setting 
(PLA=72). 


Table 3. Sensor Noise Standard Deviation in % of the 
Trim Values at Maximum Power 


Sensor 

a 

XN12 

0.25 

XN25 

0.25 

P25 

0.50 

T25 

0.75 

PS3 

0.50 

T3 

0.75 

T49 

0.75 


Piecewise Kalman Filter Model 

At the selected cruise condition, piecewise linear engine 
models are generated along the steady-state power setting line 
where PLA varies from 38 to 72 degrees. A linear engine 
model is composed of trim values and state space matrices. For 
each of these linear models, a Kalman gain is computed. Then, 
the piecewise Kalman filter model is developed by linking the 
piecewise linear models and the corresponding Kalman gains. 
The architecture of the piecewise Kalman filter model is shown 
in fig. 3. 

The piecewise Kalman filter model is composed of the 
steady-state (base-point) model, state-space matrices, and 
Kalman gains. The steady-state model captures nonlinear 
engine characteristics along the power setting line, while the 
state-space matrices (dynamic model) capture off-nominal 
engine behavior due to perturbations from the steady- state line. 
These three elements of the Kalman filter model are saved in 
table lookup form. For a given set of two input signals (u cmd , y ), 
the steady-state values, the state-space matrices, and a Kalman 
gain constitute the Kalman filter equation, by which the state 
variables and sensor outputs are estimated. As PLA moves 
from one point to another, those elements saved in the lookup 
table are interpolated linearly based on a scheduling parameter. 
In the current model, the estimated low-pressure spool speed 
(XN12) is used as the scheduling parameter. It should be noted 
that the scheduling parameter can be a function of multiple 
parameters as in references [1,8]. More detailed discussion 
regarding the piecewise linear state variable model can be 
found in references [8,9]. 

By using the architecture of fig. 3, a piecewise Kalman 
filter model is built for each fault hypothesis (eqs. 2 and 4), and 
a bank of Kalman filters is formed as shown in fig. 2. The FDI 
system is now able to cover the full PLA range at a fixed 
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Figure 3. Architecture of Piecewise Kalman 
Filter Model 

ambient condition of the selected cruise point. In order to 
expand the range of ambient conditions over which the FD1 
system can operate, the parameters of the Kalman filters must 
be corrected based on inlet condition, however, this additional 
step is not pursued in this paper. 

Selection of Tuning Parameters 

The selection of the tuning parameters for designing the 
(rn+ 1 )" Kalman filter is critical in order to achieve overall 
sensor FDI performance at an acceptable level. It is desirable 
to have some optimal selection methods; however, the tuning 
parameters used in this paper were selected by trial and error. 
The selected tuning parameters are: FAN flow capacity, BST 
flow capacity, HPC efficiency, HPC flow capacity, HPT flow 
capacity, and LPT flow capacity. With these tuning parameters, 
the Kalman filter is able to accurately estimate sensor outputs 
even if all 10 health parameters are shifted from a reference 
point. Again, it should be remembered that the tuning 
parameters do not indicate the actual health condition although 
they are selected from the health parameters. 


Modifications to the FDI System 

During the preliminary evaluation of the FDI system, it 
was found that the Kalman filter design approach for the fault 
detection of the XN25 and T25 sensors had to be modified. 
When either of these sensors is biased, the control system 
generates a large off-nominal variable stator vane (VSV) 
command. As discussed earlier, piecewise linear models are 
generated along the steady-state power setting line. Any control 
input deviation from this steady-state line is the delta input to 
the linear models. Under normal fault-free engine operation, 
any control input deltas remain relatively small, and therefore 
the linear models are valid to describe the off-nominal engine 
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behavior. However, when one of the aforementioned two 
sensors is biased, the engine operates at a condition where the 
steady-state VSV command is significantly shifted from its 
nominal value. This large shift, used as an input to linear 
model, exceeds the linear range and gives the appearance that 
VSV is biased. The assumption of the bank of Kalman filters 
for sensor FDI is that at most one sensor is faulty while the 
others, including the actuators, remain at their nominal 
condition. Therefore, with the large shift in the VSV command 
input, the Kalman filters designed for monitoring XN25 and 
T25 are not able to accurately estimate state variables and 
sensor outputs, and consequently a large fault indicator signal is 
generated. In the meantime, the Kalman filter designed with 
tuning parameters is able to generate low fault indicator signals 
since this filter can handle the shifts in multiple parameters. 
Thus, without modifications, the FDI system will misclassify 
XN25 or T25 sensor faults as the component/actuator fault 
case. 

To address this problem, the Kalman filters for the XN25 
and T25 sensors are designed based on the augmented state 
vector which is composed of the state vector and the VSV bias 
term. This approach, which was used in reference [2], allows 
the Kalman filters to estimate a bias in VSV. When a large off- 
nominal steady-state VSV value is commanded, the Kalman 
filters attribute this large input to the estimated VSV bias. With 
this modification, the effect of a large command input that 
corrupts the estimation of these Kalman filters is reduced, and 
therefore the sensor outputs are accurately estimated. The 
problem of a large off-nominal shift in the VSV command is 
specific to the control system used in the current study. If a 
different control design is employed, this problem may not be 
encountered; instead, new challenges may appear. 


PERFORMANCE EVALUATION OF THE SENSOR FDI 
SYSTEM 

In this section, the FDI system is evaluated at three PLA 
settings: 50, 60 and 68 degrees. As discussed earlier, the three 
objectives of sensor FDI are to avoid 1) missed detections, 2) 
false alarms, and 3) misclassifications. The evaluation is based 
on each of these objective categories. Additionally, the 
robustness of the FDI system is evaluated. 


Evaluation 1: Missed Detections 

When a single sensor is faulty, it must be correctly 
detected and isolated. If this objective is not achieved, it is 
considered that the FDI system missed the detection of the 
sensor fault. To assess the missed detection rate generated by 
the FDI system, it is desirable to have design specifications 
which define the bias magnitude at which sensors transition 
from “nominal” to “faulty” operation. Since such information 
is not available in this study, the minimum sensor bias that the 
proposed FDI system can isolate is determined for each of the 
sensors. If design specifications are available, the FDI system, 
or specifically the detection thresholds, may be adjusted to 
meet a desired performance level. 






Table 4 shows the minimum positive bias in each sensor 
that could be isolated by the FDI system at the three power 
settings considered. The numbers are given in percent of the 
steady-state values at the maximum power setting (PLA=72). 
All sensor biases of these magnitudes were isolated correctly. 
The magnitude of the minimum isolated bias varies with sensor 
type and also with power setting. This variation in the 
magnitude depends on how easily the “correct” Kalman filter 
can be isolated from the rest of the filters. For most of the test 
cases, the fault indicator signal which exceeded the threshold 
last (the correct one must remain below the threshold) is the 
one corresponding to the Kalman filter with tuning parameters. 
Therefore, overall sensor isolation performance of the FDI 
system depends not only on the sensor suite but also the 
selection of tuning parameters. The worst case, or the largest 
minimum bias value that could be isolated, is the 6.7% PS3 
sensor bias. If the isolation of smaller magnitude faults is 
desired, the detection thresholds must be set lower. However, 
this adjustment may result in increased false alarms and 
misclassifications. 

When PLA is moved beyond the value of 68 degrees, it 
becomes very difficult to isolate XN25 sensor bias. As 
mentioned, bias in this sensor causes a large off-nominal shift 
in the steady-state VSV command input. Similarly, the off- 
nominal steady-state shift in the WF36 command input 
increases as PLA increases. When PLA exceeds 68, this off- 
nominal WF36 shift becomes too large for the linear model to 
handle. As a result. XN25 sensor bias is diagnosed as a 
component/actuator fault by the FDI system. This problem 
may be solved by augmenting the state vector with a WF36 bias 
term as was done for the VSV input. However, this further step 
has not been taken in this work. 


Table 4. Minimum Positive Bias Isolated by the 
Sensor FDI System 

(% of Steady-State Value at Maximum Power) 



PLA=50 

PLA=60 

PLA=68 

XN12 

1.6 

1.9 

2.1 

XN25 

4.7 

4.0 

3.4 

P25 

2.9 

3.5 

5.0 

T25 

2.1 

2.0 

2.0 

PS 3 

3.2 

5.1 

6.7 

T3 

2.8 

3.5 

4.1 

T49 

2.3 

2.9 

3.2 


Evaluation 2: False Alarms 

When the FDI system is applied to a real engine, non-fault- 
related factors which exist in the real environment, such as 
sensor noise and modeling uncertainty, should not be diagnosed 
as a sensor fault. If this happens, the FDI system will have 
generated a false alarm. Since the Kalman filter design 
approach accounts for these non-fault-related factors to some 
degree, the estimator should handle them well as long as they 
do not deviate significantly from their assumed values. 

In the previous evaluation step, the FDI system was 
applied to the nonlinear engine simulation at three different 


power settings. When there was no sensor bias, no false alarm 
was generated. This means that the Kalman filters are able to 
handle the given sensor noise (table 3) and the model mismatch 
that exists between the nonlinear engine simulation and its 
linear representation. In this section, the robustness of the FDI 
system to sensor noise and modeling uncertainty is evaluated 
by varying the magnitude of these factors. 

At the steady-state condition of the three power settings 
used in the previous section, either the sensor noise level or the 
model uncertainty level is increased. By increasing these 
factors, the FDI system may eventually generate a false alarm 
(only one fault indicator signal remaining below the detection 
threshold). In this study, however, the level of sensor noise and 
model uncertainty is increased up to the initial point of fault 
detection where the threshold is just exceeded by at least one 
fault indicator signal. If the FDI system can tolerate a large 
magnitude increase in these factors, it is considered that the 
likelihood of generating false alarms is very small. 

In the simulation, the sensor noise is increased by 
multiplying the standard deviation (table 3) by a scale factor. 
Model uncertainty is introduced by shifting all 10 health 
parameters of the nonlinear engine simulation by the same 
amount from the healthy baseline. Since the FDI system was 
designed based on a “healthy” engine, the outputs of the 
“degraded” nonlinear engine simulation deviate from the design 
point of the FDI system. Table 5 shows the level of sensor 
noise scale factor and model uncertainty (steady-state model 
mismatch) that the FDI system can tolerate, i.e., all fault 
indicator signals remain below the threshold. The noise scale 
factor was increased by 1% increments while the steady-state 
model mismatch was increased by 0.1% increments to obtain 
these results. When the level of either one of these two factors 
is increased, the other was kept at the nominal design condition. 

As the noise scale factor was increased, the values of all 
WSSR signals increased even though the Kalman filters could 
maintain good estimation accuracy of sensor outputs. This 
increase is due to the fact that the normalization factor (X in 
eqs. 3 and 5) used to generate WSSR is based on the assumed 
noise intensity. Noise that exists in the real environment is 
never certain. Therefore, the detection threshold has been 
selected to account for the uncertainty in noise statistics. The 
FDI system can tolerate, at worst, a 9% (at PLA=50) noise 
increase. If this value is considered too small, then the 
detection threshold must be increased accordingly. 

Similarly, the fault indicator signals increase as the level of 
steady-state model mismatch is increased. Model mismatch 
causes a shift in all sensor measurements from the reference 
point, as if small biases were injected into all sensors. Since 
the Kalman filter assumes that the sensor outputs are corrupted 
only by white noise, it is not able to maintain good estimation 
accuracy when model mismatch is present. The variation in 
fault indicator signals due to model mismatch must be 
accounted for in threshold selection. The FDI system can 
tolerate, at worst, a 0.3% (at PLA=68) shift in all health 
parameters. Again, if this value is considered too small, then 
the detection threshold must be increased accordingly. 
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Table 5. Non-Fault-Related Factors Tolerated by the 


FDI S' 

/stem 


PLA=50 

PLA=60 

PLA=68 

Noise 

Factor 

9% 

11% 

13% 

Model 

Mismatch 

0.7% 

0.4% 

0.3% 


Evaluation 3: Misclassifications 

A misclassification is an event where the FDI system 
correctly detects a fault that exists in the engine but classifies it 
as the wrong fault. For example, when an anomaly other than a 
sensor fault occurs in the aircraft engine, the sensor FDI system 
should not classify it as a sensor fault. If it does, it is 
considered that the FDI system misclassified the fault. Such 
anomalies can occur to engine components during flight due to 
fault events such as foreign or domestic object damage. 
Anomalies can also exist in actuators due to mechanical or 
electrical failure in the actuation systems. In order to avoid 
misclassification, the FDI system contains one additional 
Kalman filter designed with tuning parameters as discussed 
earlier. When components or actuators are faulty, the two fault 
indicator signals (WSSR and WSST) of this filter should not 
exceed the threshold. If this can be achieved, the FDI system 
will not misclassify component or actuator faults as a sensor 
fault. In this section, the FDI system is evaluated as to whether 
it can avoid misclassifications of component and actuator 
faults. 

Table 6 shows the component/actuator fault scenarios used 
to evaluate the FDI system at the three power settings 
(PLA=50, 60, 68). For each engine component, both efficiency 


Table 6. Component and Actuator Fault Scenarios 
for the FDI Performance Evaluation 



Delta Range 

# of Cases 

Single 

FAN 

[1%, 4%] 

50 

Component 

BST 

[i%, 4%] 

50 

Fault 

HPC 

[1%, 4%] 

50 


HPT 

[1%, 3%] 

100 


LPT 

[1%, 3%] 

100 

Multiple 

FAN 

[2%, 4%] 

100 

Component 

BST 

[1%, 3%] 


Fault 

BST 

[2%, 4%] 

100 


HPC 

[1%, 3%] 



FAN 

[2%, 4%] 

100 


BST 

[1%, 3%] 



HPC 

[0.5%, 2%j 



HPT 

[1%, 3%] 

200 


LPT 

[1%, 3%1 


Single and 

WF36 

5% 

150 

Multiple 

VBV 

5% 


Actuator 

VSV 

5% 


Fault 





and flow capacity are shifted randomly within the range shown 
in the table. This range is considered to encompass any 
reasonable failure scenarios. All component shifts are made in 
the negative direction, except for HPT and LPT flow capacities 
which are shifted in both positive and negative directions. The 
actuator bias is also varied randomly in both positive and 
negative directions within the specified range. The actuator 
bias range is shown in percent of full-scale values. 

For the 3000 test cases evaluated (the 1000 fault scenarios 
shown in table 6 at each of the three power settings), no 
misclassifications were encountered. This demonstrates the 
significant robustness of the FDI system to component and 
actuator faults. This robustness is largely due to the Kalman 
filter with tuning parameters. If this filter is not included, the 
FDI system is more likely to misclassify faults. To verify this 
claim, the FDI system was “standardized” by removing the 
Kalman filter with tuning parameters and then re-evaluated. 
For the 1000 fault scenarios at each of the three power settings, 
the number of component/actuator fault cases that this 
“standard" FDI system misclassified as a sensor fault were as 
follows: 97 (PLA=50), 113 (PLA=60), and 108 (PLA=68). 

During the evaluation of the “robust” FDI system (the 
Kalman filter with tuning parameters included), it was noted 
that, in some of the fault scenarios, a threshold violation 
occurred for all Kalman filters. If this happens, the FDI system 
indicates that a large component/actuator fault may have 
occurred (see table 1). 


Evaluation 4: Robust Sensor Isolation 

All engine components gradually degrade with time due to 
usage. As discussed earlier, the baseline degradation (shift in 
all health parameters from the healthy baseline) can be tracked 
by ground-based trend monitoring systems, and the estimated 
baseline degradation can be used to update the FDI system for 
in-flight fault diagnostics. It is unlikely that the estimated 
baseline degradation will match perfectly with the actual 
condition. In order to assess the influence of baseline mismatch 
on the sensor fault isolation performance, the FDI system is 
evaluated in the presence of the error in the estimated baseline 
degradation. 

In this test case, the estimated baseline is set to the healthy 
baseline condition (i.e., a trend monitoring system concluding 
that the engine is healthy), and consequently the design of the 
FDI system is based on a healthy engine. This FDI system is 
then applied to the nonlinear engine simulation with small 
baseline degradation. A 0.3% shift is injected to all 10 health 
parameters. With this magnitude, the FDI system indicates that 
no fault exists in the system at the three power settings (see 
table 5). In the presence of this baseline degradation mismatch, 
a bias is injected into each sensor. Table 7 shows the minimum 
positive bias isolated by the FDI system. Again, the numbers 
are given in percent of the steady-state values at the maximum 
power setting (PLA=72). 

All sensor biases were isolated correctly, except for one 
case where the XN25 sensor is biased at a PLA setting of 68 
degrees. As discussed before, the isolation of the XN25 sensor 
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is very difficult at high power settings because of the large off- 
nominal shift in the VSV and WF36 command inputs. As a 
result, the XN25 sensor bias is misclassified as a 
component/actuator fault. Since it is known that the XN25 
sensor bias causes large shifts in multiple parameters (one 
sensor and two actuator commands), some intelligence must be 
built in to the FDI system to account for this knowledge. In the 
rest of the scenarios, the FDI system exhibits good 
performance. For some sensors, smaller bias can be isolated 
compared to the results shown in table 4. The worst case, or 
the largest minimum bias value that could be isolated, is the 
6.0% PS3 sensor bias. It is especially encouraging that the FDI 
system did not attribute a fault in one sensor to a different 
sensor which, if it had occurred, would have created a very 
challenging environment for further accommodation steps. 


Table 7. Minimum Positive Bias Isolated by the 
Sensor FDI System in the Presence of 0.3% Baseline 
Degradation Mismatch 



PLA=50 

PLA=60 

PLA=68 

XNI2 

1.7 

2.1 

2.3 

X.X25 

43 

33 

Misclassification 

P25 

31) 

3/7 

4.9 

T25 

22 

24 

2.0 

PS 3 

23 

43 

6.0 

f 3 

34 

3/9 

4.5 

T49 

L9 

2 A 

2.7 


DISCUSSION 

In-depth evaluation is a critical part in the development of 
an in-flight FDI system. The multiple objectives that the FDI 
system must handle often conflict with each other. 
Consequently, enhancing one aspect of the FDI performance 
does not necessarily result in the enhancement of overall 
performance. For instance, the minimum sensor bias 
magnitudes that the FDI system can isolate may be reduced by 
setting detection thresholds at a lower value. This modification, 
however, may result in increased false alarms and 
misclassifications. Through extensive evaluation, the FDI 
system can be matured to a point where its overall performance 
is satisfactory. To reach such a mature point, the sensor FDI 
system developed in this paper needs further evaluation and 
enhancement. Some of the issues that must be addressed in 
future work are discussed below. 

First, the ambient conditions over which the FDI system 
can operate must be expanded. In the real environment, the 
ambient condition continually changes even in the cruise phase. 
As discussed earlier, this expansion can be accomplished by 
correcting the parameters of the Kalman filters based on inlet 
pressure and temperature measurements. In this “corrected” 
dimension, the FDI system must be evaluated for its diagnostic 
performance, sensitivity to ambient condition changes, and 
sensitivity to inlet sensor faults. 


The evaluation results presented in this paper were 
obtained at fixed PLA values or fixed target low-pressure spool 
speeds (a fixed PLA value does not necessarily mean a fixed 
steady-state condition when faults are present in the system). 
Since the PLA movement is expected to be small in the cruise 
phase of a commercial aircraft, the FDI system was developed 
to be robust enough to handle small PLA movements, i.e., false 
alarms are not generated during minor transients. When the 
FDI system operates under relatively large PLA movements, 
however, some of the sensor estimates lag behind the actual 
measurements, causing an increase in the fault indicator 
signals. Eventually, the fixed detection thresholds are exceeded, 
and false alarms are generated. To account for relatively large 
PLA movements, adaptive detection thresholds which vary 
with transient conditions need to be introduced, as done in 
reference [1], Then, the FDI system needs to be evaluated for 
its diagnostic capability during PLA transients. 


CONCLUSION 

An approach based on a bank of Kalman filters was 
investigated for the development of an aircraft engine sensor 
fault detection and isolation (FDI) system. This approach 
utilizes multiple Kalman filters, each of which is designed 
based on a specific fault hypothesis. When the propulsion 
system experiences a fault, only one Kalman filter with the 
correct hypothesis can maintain the nominal estimation 
performance. Based on this knowledge, the isolation of faults 
is conducted. The sensor FDI system developed in this paper 
utilizes a bank of (m+l) Kalman filters where m is the number 
of sensors being monitored. The additional Kalman filter is 
used to detect component and actuator faults. With this setup, 
the isolation of sensor faults or the detection of 
component/actuator faults can be achieved. 

The sensor FDI system was applied to a commercial 
aircraft engine simulation, and its performance was evaluated at 
multiple power settings at a cruise operating point. After an 
extensive evaluation, the following three conclusions can be 
made: 1) the FDI system can correctly isolate a faulty sensor, 2) 
the FDI system can tolerate variations in sensor noise and 
model uncertainty, and 3) the FDI system is robust to 
component and actuator faults in terms of avoiding 
misclassifications. Some difficulties in isolating faults in two 
sensors due to the influence of the engine control system were 
noted. Further study is needed in the area of integration with 
control systems for performance improvement of the FDI 
system. 
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